{"id":"CVE-2018-8453","published":"2018-10-10T13:29:02Z","modified":"2026-08-13T05:17:19Z","title":"Microsoft Win32k Privilege Escalation Vulnerability","vendor":"Microsoft","product":"Win32k","tier":"core","eol":null,"description":{"text":"An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka \"Win32k Elevation of Privilege Vulnerability.\" This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.","provenance":"source","from":"NVD"},"summary":{"text":"The Win32k component in Microsoft Windows fails to properly handle objects in memory, producing an elevation of privilege flaw that affects multiple Windows client and server releases. An attacker with local access to a vulnerable system who can get a user to interact with a crafted element, such as opening a file or running an application, can gain elevated privileges, with no authentication required beforehand.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T06:55:43Z"},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.70042,"percentile":0.99374,"date":"2026-10-28","provenance":"source"},"kev":{"dateAdded":"2022-01-21","dueDate":"2022-07-21","ransomware":true,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2018-8453","provenance":"source"},"vulncheckKev":{"dateAdded":"2018-08-17","exploitedFirstSeen":"2018-08-17","ransomware":true,"evidence":[{"url":"https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit","date":"2018-08-17"},{"url":"https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2018-Oct","date":"2018-10-09"},{"url":"https://securelist.com/zero-day-in-windows-kernel-transaction-manager-cve-2018-8611/89253/","date":"2018-12-12"},{"url":"https://securelist.com/cve-2019-0797-zero-day-vulnerability/89885/","date":"2019-03-13"},{"url":"https://digital.nhs.uk/cyber-alerts/2019/cc-3044","date":"2019-05-01"},{"url":"https://www.cyber.nj.gov/threat-center/threat-profiles/ransomware-variants/sodinokibi","date":"2019-05-02"},{"url":"https://web.archive.org/web/20220227045141/https://risksense.com/wp-content/uploads/2019/09/RiskSense-Spotlight-Report-Ransomware.pdf","date":"2019-09-01"},{"url":"https://www.secureworks.com/blog/revil-the-gandcrab-connection","date":"2019-09-24"},{"url":"https://www.secureworks.com/research/revil-sodinokibi-ransomware","date":"2019-09-24"},{"url":"https://www.tenable.com/blog/cve-2019-11510-critical-pulse-connect-secure-vulnerability-used-in-sodinokibi-ransomware","date":"2020-01-07"}],"evidenceTotal":23,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-404","name":"Improper Resource Shutdown or Release"}],"references":[{"url":"http://packetstormsecurity.com/files/153669/Microsoft-Windows-NtUserSetWindowFNID-Win32k-User-Callback.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://www.securityfocus.com/bid/105467","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1041828","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8453","tags":["Patch","Vendor Advisory"]},{"url":"https://securelist.com/cve-2018-8453-used-in-targeted-attack","tags":["Exploit","Technical Description","Third Party Advisory"]},{"url":"http://packetstormsecurity.com/files/153669/Microsoft-Windows-NtUserSetWindowFNID-Win32k-User-Callback.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://www.securityfocus.com/bid/105467","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1041828","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8453","tags":["Patch","Vendor Advisory"]},{"url":"https://securelist.com/cve-2018-8453-used-in-targeted-attack","tags":["Exploit","Technical Description","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-8453","tags":["US Government Resource"]}],"techniques":[{"id":"T1608","name":"Stage Capabilities","tactics":["resource-development"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 1)","mappingType":"uncategorized","evidence":[],"confidence":"low","confidenceNote":"CTID attack_to_cve Phase 1 \"Uncategorized\" mapping (not staged by impact)"},{"id":"T1068","name":"Exploitation for Privilege Escalation","tactics":["privilege-escalation"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Local privilege escalation via kernel component bug","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"An elevation of privilege vulnerability exists in Windows when the Win32k component","start":0,"end":83}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[{"id":"SRC-b18366d8718ee8888eed","title":"REvil Ransomware-as-a-Service: An analysis of a ransomware affiliate operation","publisher":"intel471.com","url":"https://www.intel471.com/blog/revil-ransomware-as-a-service-an-analysis-of-a-ransomware-affiliate-operation","date":null,"mentions":[{"quote":"Exploits a kernel privilege escalation vulnerability to gain SYSTEM privileges using CVE-2018-8453.","start":528,"end":627},{"quote":"REvil ransomware exploits a kernel privilege escalation vulnerability in win32k.sys tracked as CVE-2018-8453 to gain SYSTEM privileges on the infected host.","start":5893,"end":6049},{"quote":"The screenshot below shows the window name sysshadow and the application programming interface (API) DestroyWindow inside the embedded exploit, proving it is the CVE-2018-8453 vulnerability.","start":6224,"end":6414},{"quote":"One technique relies on exploiting the CVE-2018-8453 vulnerability to gain SYSTEM privileges on the host.","start":9768,"end":9873},{"quote":"The first JSON field checked is exp, which can be true or false and indicates whether the CVE-2018-8453 vulnerability should be exploited.","start":10894,"end":11032}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2018-20088","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-20088","exploited":true,"exploitedSince":"2022-01-21","provenance":"source"},"exploits":[{"id":47134,"url":"https://www.exploit-db.com/exploits/47134","title":"Microsoft Windows - NtUserSetWindowFNID Win32k User Callback Privilege Escalation (Metasploit)","type":"local","platform":"windows","date":"2019-07-17","verified":true,"provenance":"source"},{"id":47134,"url":"https://www.exploit-db.com/exploits/47134","title":"Microsoft Windows - NtUserSetWindowFNID Win32k User Callback Privilege Escalation (Metasploit)","type":"local","platform":"windows","date":"2019-07-17","verified":true,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":2,"earliest":"2019-07-17"},"pocGithub":{"count":3,"skipped":0,"earliest":"2019-01-18","earliestUrl":"https://github.com/Mkv4/cve-2018-8453-exp","repos":[{"name":"ze0r/cve-2018-8453-exp","url":"https://github.com/ze0r/cve-2018-8453-exp","stars":119,"created":"2019-01-18"},{"name":"thepwnrip/leHACK-Analysis-of-CVE-2018-8453","url":"https://github.com/thepwnrip/leHACK-Analysis-of-CVE-2018-8453","stars":14,"created":"2019-07-08"},{"name":"Mkv4/cve-2018-8453-exp","url":"https://github.com/Mkv4/cve-2018-8453-exp","stars":2,"created":"2019-01-18"}]},"metasploit":[{"name":"Windows NtUserSetWindowFNID Win32k User Callback","module":"exploit/windows/local/cve_2018_8453_win32k_priv_esc","type":"exploit","disclosureDate":"2018-10-09","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/cve_2018_8453_win32k_priv_esc.rb"}],"first":{"date":"2018-10-09","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/cve_2018_8453_win32k_priv_esc.rb"},"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/153669/Microsoft-Windows-NtUserSetWindowFNID-Win32k-User-Callback.html","https://securelist.com/cve-2018-8453-used-in-targeted-attack"],"flow":[{"stage":"exploitation","techniques":["T1068"],"provenance":"ai"},{"stage":"related","techniques":["T1608"],"provenance":"source","lowConfidence":true}],"timeline":[{"date":"2018-08-17","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit","provenance":"source"},{"date":"2018-10-09","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2019-01-18, Exploit-DB 2019-07-17","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/cve_2018_8453_win32k_priv_esc.rb","provenance":"source"},{"date":"2018-10-10","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2018-8453","provenance":"source"},{"date":"2022-01-21","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-01-21","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-20088","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":1199},"priority":{"score":82.2,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 2995 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.87,"detail":"percentile 0.9937"},{"name":"Named in threat reports","points":3.87,"detail":"1 report"},{"name":"Public exploit code","points":5.0,"detail":"2 NVD references tagged Exploit; 2 Exploit-DB entries; 3 PoC-in-GitHub repos; 1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":5.46,"detail":"base score 7.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}